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Remarks 

Claims 1-5, 7, 9-20, 24, 26-38, 42, and 44-53 are pending. 

Response to Arguments 

1 . Applicant's arguments filed 2/28/2006 have been fully considered but they are 
not persuasive. 

Applicant argues that Yarborough does not disclose mapping rules including 
information on establishing the data transmission link between the client proxy device 
and the proxy server. The GPS of Yarborough sets up a main proxy control connection 
with the PPS (Column 5, line 65 to Column 6, line 7). After this is done, the PPS is 
allowed to send connection requests to the GPS over this connection, this request 
comprising information regarding the host that it wishes to connect to, as well as a port 
that the PPS obtained from a port to service map (Column 6, lines 39-49). After 
receiving this request, the GPS will create a connection with the destination host 
(Column 6, lines 61-65) and will thereafter complete the session connection with the 
PPS (Column 7, lines 9-20). The fact that this session connection between PPS and 
GPS is outbound is insignificant since the PPS is the entity that sends a request to the 
GPS for this connection. The information on establishing the data transmission link 
between the client proxy device and the proxy server can be viewed simply as being 
able to form this session connection request, or it can be viewed as being more in 
depth, including the port to service map and/or other components used by the PPS. 
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Applicant also argues that Yarborough does not disclose that the mapping rules 
include connection information of at least one port of the proxy server to at least one 
port of the at least one network server. As can be seen in Column 7, lines 9-20, the 
PPS knows the socket S2 on the GPS since it sends information to the GPS on that 
socket. The PPS also knows the socket S3 and the destination host because, once the 
connections have been established, GPD "sends a connection reply to PPS 18 
containing the end-points for connection S3 to the destination host". The PPS 
additionally recognizes the destination host from the port obtained from the port to 
service map. 

An additional grounds of rejection has been used for 7, 24, and 42, which is 
proper since the claims have been amended to state that the network connect module is 
now within the client proxy device, as opposed to simply being coupled to the client 
proxy device. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 
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2. Claims 1-5, 7, 11, 12, 14, 15, 17, and 53 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Yarborough (U.S. Patent 6,718,38). 
Regarding Claim 1, 

Yarborough discloses a system for enabling a user to access a 
LAN from a remotely located host in a computer network comprising: 

A client proxy device adapted to receive a request of a client data 
processing device to access at least one network server (Column 6, lines 
23-38), wherein the client proxy device includes a network connect 
module (Column 6, lines 15-49); 

Wherein the network connect module, in response to the request, 
establishes a communication link including a data transmission link 
between the client proxy device and a proxy server coupled to the at least 
one network server (Column 7, lines 9-64); 

The network connect module is arranged for retrieving mapping 
rules corresponding to the client proxy device and the proxy server, 
wherein the mapping rules include information on establishing the data 
transmission link between the client proxy device and the proxy server 
(Column 6, lines 8-14 and 39-49; and Column 7, lines 9-35); and 

The network connect module further comprises a first sub- 
connection module including submapping rules having connection 
information of at least one port of the client proxy device to at least one 
port of the proxy server (Column 7, lines 9-40; sockets S4 and S2, 
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respectively); and a second sub-connection module including submapping 
rules having connection information of at least one port of the proxy server 
to at least one port of the at least one network server (Column 6, lines 15- 
49; and Column 7, lines 9-40; socket S3 and the host port, as in Column 
6', lines 18-19, respectively). 

Regarding Claim 2, 

Yarborough discloses that the network connect module further 
comprises a network server selector wherein the network server is 
selected using information included in the request from the client data 
processing device (Column 6, lines 47-49). 

Regarding Claim 3, 

Yarborough discloses that the network connect module further 
comprises a network server selector wherein the network server is 
selected using information of a port at the client proxy device that received 
the request (Column 6, lines 23-49). 

Regarding Claim 4, 

Yarborough discloses that the communication link between the 
client proxy device and the at least one network server includes at least 
one port of the client proxy device and at least one port of the at least one 
network server (Column 6, lines 15-49; and Column 7, lines 9-40). 

Regarding Claim 5, 
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Yarborough discloses that the network connect module is arranged 
to generate a list of assignments between at least one port of the client 
proxy device and at least one port of the at least one network server 
(Column 6, lines 23-49). The client and service information is stored in the 
memory vector array, and the server's port is mapped to the service based 
upon the service table. 
Regarding Claim 7, 

Yarborough discloses that the mapping rules further include 
address information of the at least one network server in the LAN (Column 
6, lines 39-49). The address of the GPS is what the PPS thinks is the 
destination server, and once the port number for the service is sent to the 
GPS, the GPS will translate the port to the correct final destination. 
Regarding Claim 11, 

Yarborough discloses that the data transmission link between the 
client proxy device and the proxy server is established through a firewall 
restricting access to the LAN (Column 5, lines 1-13; and Figure 2). 
Regarding Claim 12, 

Yarborough discloses that the communication link further 
comprises: 

A first mapping module including mapping rules having connection 
information of a port of the client proxy device to a port of the firewall 
(Column 5, lines 27-41; and Column 7, lines 9-20; PPS to firewall); and 
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A second mapping module including mapping rules having 
connection information of a port of the firewall to a port of the proxy server 
(Column 5, lines 27-41; and Column 7, lines 9-20; GPS to firewall). 
Regarding Claim 14, 

Yarborough discloses that the proxy server is located inside a 
firewall restricting access to the LAN from the outside (Column 5, lines 1- 
13; and Figure 2). 
Regarding Claim 15, 

Yarborough discloses that the proxy server is configured to allow 
access only to pre-selected network servers and services (Column 6, lines 
23-57). 
Regarding Claim 17, 

Yarborough discloses a replacement module containing 
replacement information used when executing an application that is not 
proxy enabled, wherein the name of a network server is replaced by the 
name of a client proxy device and a specified port associated with the 
client proxy device (Column 6, lines 23-38). 
Regarding Claim 53, 

Yarborough discloses a system for enabling a user to access a 
LAN from a remotely located host in a computer network, comprising: 

A client proxy device coupled to and adapted to exchange data with 
a client data processing device upon a request of the client data 
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processing device to access at least one network server in the LAN 
(Column 6, lines 23-38), wherein the client proxy device includes: 

A connection module for establishing a communication link 
between the client proxy device and the at least one network server upon 
the request of the client data processing device, wherein the 
communication link includes a data transmission link between the client 
proxy device and a proxy server device coupled to the at least one 
network server (Column 7, lines 9-64), and the connection module selects 
at least one network server in the LAN based on the request and further 
wherein the connection module is arranged for retrieving mapping rules 
corresponding to the client proxy device and the proxy server, wherein the 
mapping rules include information on establishing the data transmission 
link between the client proxy device and the proxy server (Column 6, lines 
8-14 and 39-49; and Column 7, lines 9-35); and 

The connection module further comprises: 

A first sub-connection module including submapping rules having 
connection information of at least one port of the client proxy device to at 
least one port of the proxy server (Column 7, lines 9-40); and 

A second sub-connection module including submapping rules 
having connection information of at least one port of the proxy server to at 
least one port of the at least one network server (Column 6, lines 15-49; 
and Column 7, lines 9-40). 
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3. Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Yarborough in view of Srisuresh (Srisuresh et al., "RFC 2391 - Load Sharing using IP 
Network Address Translation (LSNAT)", 8/1998, pp. 1-15). 

Yarborough discloses that the mapping rules further include identifying 
information of the at least one network server in the LAN (Column 6, lines 39-49). 

Srisuresh, however, discloses that the identifying information is address 
information (Pages 5-10, Section 3). It would have been obvious to one of 
ordinary skill in the art at the time of applicant's invention to incorporate the 
LSNAT of Srisuresh into the secure session establishment system of Yarborough 
in order to obtain the benefits of both network address translation, namely to 
conserve globally-unique addresses, while allowing private networks to each 
have the same private addresses within, and load sharing, to lessen the amount 
of processing that a single server must provide by distributing such processing 
amongst multiple servers. 



4. Claims 9 and 13 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Yarborough in view of Crichton (U.S. Patent 6,104,716). 
Regarding Claim 9, 

Yarborough discloses secure communications across a public 
network (Column 7, line 65 to Column 8, line 21), but does not disclose 
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that the link between the proxy server and the client proxy device is on a 
public network. 

Crichton, however, discloses that the link between the proxy server 
and the client proxy device is on a secure communication via a public 
network (Figure 4). It would have been obvious to one of ordinary skill in 
the art at the time of applicant's invention to incorporate the secure 
tunneling system of Crichton into the secure session establishment 
system of Yarborough in order to allow multiple private intranets to be 
connected in a public environment, so that they can securely share each 
others resources as needed, such as when cooperating on a project. 
Regarding Claim 13, 

Yarborough does not disclose that the client data processing device 
is part of a client network and the data transmission link between the client 
proxy device and the proxy server is further established through a firewall 
restricting access to the client network. 

Crichton, however, discloses that the client data processing device 
is part of a client network and the data transmission link between the client 
proxy device and the proxy server is further established through a firewall 
restricting access to the client network (Figure 4). It would have been 
obvious to one of ordinary skill in the art at the time of applicant's invention 
to incorporate the secure tunneling system of Crichton into the secure 
session establishment system of Yarborough in order to allow multiple 
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private intranets to be connected in a public environment, so that they can 
securely share each others resources as needed, such as when 
cooperating on a project. 



5. Claims 10, 18-20, 24, 27-29, 31, 32, 34-38, 42, 45-47, 49, 50, and 52 are 
rejected under 35 U.S.C. 103(a) as being unpatentable over Yarborough in view of 
Wasserman (U.S. Patent 6,304,969). 
Regarding Claim 10, 

Yarborough does not disclose that the request of the client data 
processing device to access at least one network server is authorized 
prior to establishing the communication link. 

Wasserman, however, discloses that the request of the client data 
processing device to access at least one network server is authorized 
prior to establishing the communication link (Column 9, lines 12 to Column 
1 1 , line 30). It would have been obvious to one of ordinary skill in the art 
at the time of applicant's invention to incorporate the authorization system 
of Wasserman into the secure session establishment system of 
Yarborough in order to verify that the server is a legitimate server that is 
authorized to serve the client, as well as allow the server to verify the 
identity of the client. 
Regarding Claim 36, 

Yarborough discloses a computer system comprising: 
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A processor (Column 5, lines 41-64); and 

A memory storing a method for enabling a user to access a LAN 
from a client device in a publicly accessible computer network and not 
directly connected to the LAN (Column 5, lines 41-64; and Figure 2), 
wherein upon execution of the method on the processor the method 
comprises: 

Receiving at a client proxy device a data request from a client data 
processing device for data accessible from at least one network server in 
the LAN (Column 6, lines 23-38); 

Establishing a data transmission link between the client proxy 
device and a proxy server connected to the at least one network server in 
the LAN by a module of the client proxy device (Column 7, lines 9-64); 

Establishing a communication link between the client proxy device 
and the at least one network server by the module, wherein the 
communication link includes the data transmission link (Column 7, lines 9- 
64); 

Establishing the communication link between the client proxy 
device and the at least one network server includes: 

Retrieving mapping rules, by the module, corresponding to 
the client proxy device and the proxy server, wherein the mapping 
rules include information on establishing the data transmission link 
between the client proxy device and the proxy server (Column 6, 
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lines 8-14 and 39-49; and Column 7, lines 9-35); and further 
wherein: 

The mapping rules include submapping rules having 
connection information of at least one port of the client proxy device 
to at least one port of the proxy server (Column 7, lines 9-40; 
sockets S4 and S2, respectively); and 

The mapping rules further include submapping rules having 
connection information of at least one port of the proxy server to at 
least one port of the at least one network server (Column 6, lines 
15-49; and Column 7, lines 9-40; socket S3 and the host port, as in 
Column 6, lines 18-19, respectively); 

Mapping at least one port of the client proxy device to at 
least one port of the proxy server (Column 7, lines 9-40; sockets S4 
and S2, respectively); and 

Mapping the at least one port of the proxy server to at least 
one port of the at least one network server wherein the mappings 
are executed in accordance with the retrieved mapping rules by the 
module (Column 6, lines 15-49; and Column 7 ( lines 9-40; socket 
S3 and the host port, as in Column 6, lines 18-19, respectively); 
But does not disclose authorizing at least one network server to 
serve the data request of the client data processing device. 
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Wasserman, however, discloses authorizing at least one network 
server to serve the data request of the client data processing device 
(Column 9, line 1 2 to Column 1 1 , line 30). It would have been obvious to 
one of ordinary skill in the art at the time of applicant's invention to 
incorporate the authorization system of Wasserman into the secure 
session establishment system of Yarborough in order to verify that the 
server is a legitimate server that is authorized to serve the client, as well 
as allow the server to verify the identity of the client. 
Regarding Claim 18, 

Claim 18 is a method claim that corresponds to system claim 36 
and is rejected for the same reasons. 
Regarding Claim 35, 

Claim 35 is a computer program product that corresponds to 
system claim 36 and is rejected for the same reasons. 
Regarding Claim 37, 

Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Yarborough discloses that the at least one network 
server serving the data request is selected based on a port of the client 
proxy device receiving the data request (Column 6, lines 23-49). 
Regarding Claim 19, 

Claim 19 is a method claim that corresponds to system claim 37 
and is rejected for the same reasons. 
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Regarding Claim 38, 

Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Yarborough discloses that the at least one network 
server serving the data request is selected based on information included 
in the request (Column 6, lines 47-49). 
Regarding Claim 20, 

Claim 20 is a method claim that corresponds to system claim 38 
and is rejected for the same reasons. 
Regarding Claim 42, 

Yarborough discloses that the mapping rules further include 
address information of the at least one network server in the LAN (Column 
6, lines 39-49). 
Regarding Claim 24, 

Claim 24 is a method claim that corresponds to system claim 42 
and is rejected for the same reasons. 
Regarding Claim 45, 

Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Wasserman discloses that the request of the client 
data processing device to access at least one network server is authorized 
prior to establishing the communication link (Column 9, line 12 to Column 
11, line 30). 
Regarding Claim 27, 
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Claim 27 is a method claim that corresponds to system claim 45 
and is rejected for the same reasons. 
Regarding Claim 46, 

Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Yarborough discloses that the data transmission link 
between the client proxy device and the proxy server is established 
through a firewall restricting access to the LAN (Column 5, lines 1-13; and 
Figure 2). 
Regarding Claim 28, 

Claim 28 is a method claim that corresponds to system claim 46 
and is rejected for the same reasons. 
Regarding Claim 47, 

Yarborough as modified by Wasserman discloses the system of 
claim 46, in addition, Yarborough discloses mapping a port of the client 
proxy device to a port of the firewall and mapping the port of the firewall to 
a port of the proxy server (Column 5, lines 27-41; and Column 7, lines 9- 
20). 

Regarding Claim 29, 

Claim 29 is a method claim that corresponds to system claim 47 
and is rejected for the same reasons. 
Regarding Claim 49, 
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Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Yarborough discloses that the proxy server is located 
inside a firewall restricting access to the LAN (Column 5, lines 1-13; and 
Figure 2). 
Regarding Claim 31, 

Claim 31 is a method claim that corresponds to system claim 49 
and is rejected for the same reasons. 
Regarding Claim 50, 

Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Yarborough discloses that the proxy server is 
configured to allow access only to selected network servers (Column 6, 
lines 23-57). 
Regarding Claim 32, 

Claim 32 is a method claim that corresponds to system claim 50 
and is rejected for the same reasons. 
Regarding Claim 52, 

Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Yarborough discloses replacing at the client data 
processing device the name of the at least one network server by the 
name of the client proxy device and a specific port of executing an 
application that is not proxy enabled (Column 6, lines 23-38). 
Regarding Claim 34, 
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Claim 34 is a method claim that corresponds to system claim 52 
and is rejected for the same reasons. 



6. Claim 16 is rejected under 35 U.S.C. 103(a) as being unpatentable over 

Yarborough in view of Pistriotto (U.S. Patent 6,138,162). 

Yarborough does not disclose that the client data processing device 
further comprises a registration module containing designation information 
wherein the client proxy device is designated as a proxy enabling execution of an 
application that is proxy enabled. 

Pistriotto, however, discloses that the client data processing device further 
comprises a registration module containing designation information wherein the 
client proxy device is designated as a proxy enabling execution of an application 
that is proxy enabled (Column 7, line 37 to Column 8, line 14). It would have 
been obvious to one of ordinary skill in the art at the time of applicant's invention 
to incorporate the caching proxy system of Pistriotto into the secure session 
establishment system of Yarborough in order to allow the client to connect to 
multiple proxies, each containing multiple proxy agents, each handling 
specialized requests, thus making the system more efficient. 



7. Claims 26, 30, 44, and 48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Yarborough in view of Wasserman, further in view of Crichton. 
Regarding Claim 44, 
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Yarborough as modified by Wasserman discloses the system of 
claim 36, in addition, Yarborough discloses secure communications 
across a public network (Column 7, line 65 to Column 8, line 21), but does 
not disclose that the link between the proxy server and the client proxy 
device is on a public network. 

Crichton, however, discloses that the data transmission link 
between the proxy server and the client proxy device involves a secure 
communication via a public network (Figure 4). It would have been 
obvious to one of ordinary skill in the art at the time of applicant's invention 
to incorporate the secure tunneling system of Crichton into the secure 
session establishment system of Yarborough in order to allow multiple 
private intranets to be connected in a public environment, so that they can 
securely share each others resources as needed, such as when 
cooperating on a project. 
Regarding Claim 26, 

Claim 26 is a method claim that corresponds to system claim 44 
and is rejected for the same reasons. 
Regarding Claim 48, 

Yarborough as modified by Wasserman does not disclose that the 
client data processing device is part of a client network and the data 
transmission link between the client proxy device and the proxy server is 
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further established through a firewall restricting access to the client 
network. 

Crichton, however, discloses that the client data processing device 
is part of a client network and the data transmission link between the client 
proxy device and the proxy server is further established through a firewall 
restricting access to the client network (Figure 4). It would have been 
obvious to one of ordinary skill in the art at the time of applicant's invention 
to incorporate the secure tunneling system of Crichton into the secure 
session establishment system of Yarborough in order to allow multiple 
private intranets to be connected in a public environment, so that they can 
securely share each others resources as needed, such as when 
cooperating on a project. 
Regarding Claim 30, 

Claim 30 is a method claim that corresponds to system claim 48 
and is rejected for the same reasons. 



8. Claims 33 and 51 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Yarborough in view of Wasserman, further in view of Pistriotto. 
Regarding Claim 51, 

Yarborough as modified by Wasserman does not disclose 
registering the client proxy device as a proxy at the client data processing 
device for executing an application that is proxy enabled. 
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Pistriotto, however, discloses registering the client proxy device as 
a proxy at the client data processing device for executing an application 
that is proxy enabled (Column 7, line 37 to Column 8, line 14). It would 
have been obvious to one of ordinary skill in the art at the time of 
applicant's invention to incorporate the caching proxy system of Pistriotto 
into the secure session establishment system of Yarborough in order to 
allow the client to connect to multiple proxies, each containing multiple 
proxy agents, each handling specialized requests, thus making the system 
more efficient. 
Regarding Claim 33, 

Claim 33 is a method claim that corresponds to system claim 51 
and is rejected for the same reasons. 



9. Claims 24 and 42 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Yarborough in view of Wasserman, further in view of Srisuresh. 
Regarding Claim 42, 

Yarborough discloses that the mapping rules further include 
identifying information of the at least one network server in the LAN 
(Column 6, lines 39-49). 

Srisuresh, however, discloses that the identifying information is 
address information (Pages 5-10, Section 3). It would have been obvious 
to one of ordinary skill in the art at the time of applicant's invention to 
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incorporate the LSNAT of Srisuresh into the secure session establishment 
system of Yarborough in order to obtain the benefits of both network 
address translation, namely to conserve globally-unique addresses, while 
allowing private networks to each have the same private addresses within, 
and load sharing, to lessen the amount of processing that a single server 
must provide by distributing such processing amongst multiple servers. 
Regarding Claim 24, 

Claim 24 is a method claim that corresponds to system claim 42 
and is rejected for the same reasons. 



Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
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the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jeffrey D. Popham whose telephone number is (571)- 

272- 7215. The examiner can normally be reached on M-F 9:00-5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571)272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 

273- 8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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